5 Critical Steps to Take Today After the DOJ's Corporate Liability Policy Shift

1. Immediate Self-Disclosure: The New Presumption of Declination

In my 25 years as a federal prosecutor, I have never seen a policy shift as dramatic as the DOJ's revised Corporate Enforcement Policy, codified in Justice Manual § 9-28.000. Effective immediately, any company that voluntarily self-discloses criminal conduct by any employee—not just senior executives—within a reasonable time after becoming aware of the misconduct will receive a presumption of declination. This means the DOJ will presumptively decline to prosecute the company, provided there is no aggravating factor such as executive involvement or pervasive misconduct. However, the window for self-disclosure is narrow: you must act within a "reasonable time," which the DOJ now defines as no more than 30 days from the date the company's board or general counsel learns of credible evidence of a violation. Failure to self-disclose within this window shifts the burden to the company to prove it deserves any cooperation credit at all. In practice, this means your legal team must now treat every internal investigation as a race against the clock, because every day of delay erodes your presumption of declination.

2. Preserve All Ephemeral Messaging and Communications Immediately

One of the most critical operational changes under the new policy is the DOJ's heightened focus on ephemeral messaging platforms, such as Signal, WhatsApp, and Telegram. Under the revised guidance, the DOJ will now treat a company's failure to preserve all relevant communications—including those on personal devices and third-party apps—as a presumptive aggravating factor in charging decisions. The policy explicitly references Rule 16 of the Federal Rules of Criminal Procedure, which requires the government to demand all relevant data, and now imposes a reciprocal obligation on companies to demonstrate they have implemented a "litigation hold" within 72 hours of learning of an investigation. In my experience, the most common mistake I see is companies assuming that internal policies against using ephemeral messaging suffice; they do not. You must now have technology in place that automatically captures and archives all business-related communications, regardless of the platform, and you must be able to produce those records to the DOJ on demand. If you cannot, the DOJ will presume that the missing communications contain evidence of obstruction or concealment, which can transform a declinable matter into a criminal indictment under 18 U.S.C. § 1519.

3. Mandate Full Individual Accountability for All Employees

The new policy eliminates the old distinction between "low-level" employees and "senior executives" when it comes to cooperation credit. Under the revised Justice Manual § 9-28.700, the DOJ now requires companies to disclose all relevant facts about every individual involved in the misconduct, regardless of their role or tenure. This means you cannot shield even a mid-level manager or a whistleblower who participated in the scheme, because the DOJ will view any attempt to protect an individual as a lack of full cooperation. In my years of practice, I have seen prosecutors use this provision to extract testimony against entire compliance departments, and the new policy explicitly warns that "selective cooperation" will result in a denial of all credit. To comply, your legal team must immediately interview every potential witness, obtain all relevant documents, and prepare a comprehensive report that identifies every employee with culpable intent. The DOJ is now using the principles of 18 U.S.C. § 371 (conspiracy) to hold companies liable for failing to report co-conspirators, so your disclosure must be exhaustive. If you have any doubt about whether an employee's conduct is criminal, err on the side of disclosure; the DOJ will find out eventually, and the penalty for concealment is now a mandatory criminal referral.

4. Overhaul Your Compliance Program to Focus on Proactive Monitoring

The DOJ's new policy makes it clear that a compliance program is no longer just a defense at sentencing—it is now a factor in the initial charging decision. Under the revised guidance, the DOJ will evaluate whether your company had an "effective" compliance program at the time of the misconduct, using criteria from the U.S. Sentencing Guidelines § 8B2.1. This means your program must include proactive monitoring of high-risk areas, such as anti-bribery compliance under the Foreign Corrupt Practices Act (15 U.S.C. § 78dd-1) and healthcare fraud under 18 U.S.C. § 1347. In my experience, the most effective programs use data analytics to flag unusual patterns in financial transactions, procurement, and employee communications. The DOJ specifically looks for "continuous improvement," meaning you must document every change you make to your program based on lessons learned from internal audits or industry trends. I also recommend implementing a whistleblower hotline that is independent of management and offers anonymity, because the DOJ now treats a lack of such a mechanism as a red flag. If your program is found to be inadequate at the time of the violation, the DOJ will use that as an aggravating factor to justify an indictment, even if you later self-disclose.

5. Engage Outside Counsel Immediately to Conduct a Privileged Internal Investigation

Given the compressed timeline under the new policy, you cannot afford to rely solely on in-house legal teams. The DOJ expects that any self-disclosure will be accompanied by a thorough, independent, and privileged internal investigation conducted by outside counsel. Under the revised policy, the DOJ will give "substantial weight" to the quality of the investigation report, including whether it identifies all root causes and recommends specific remediation measures. In my 25 years, I have seen companies lose cooperation credit because their internal investigation was deemed "superficial" or "incomplete" by prosecutors. You must engage a law firm with deep experience in federal criminal practice, particularly in the relevant substantive area (e.g., FCPA, antitrust under the Sherman Act, or securities fraud under 15 U.S.C. § 78j(b)). The investigation should include forensic data collection, witness interviews under the Upjohn warning, and a written report that the DOJ can rely on without needing to duplicate your efforts. Remember, the DOJ now requires you to produce the investigation report as part of your cooperation, so it must be accurate, complete, and free of any exculpatory omissions. Do not wait for a subpoena to arrive—by then, the 30-day self-disclosure window will have already closed.

If your company is facing a potential federal investigation, you cannot afford to wait. In my 25 years as a federal prosecutor and now as a defense attorney, I have seen the DOJ move with unprecedented speed under this new policy, and the consequences of inaction are severe. Contact my office immediately for a confidential consultation. We will conduct a privileged assessment of your exposure, help you prepare a timely self-disclosure, and ensure your compliance program meets the DOJ's new standards. Do not let the 30-day window close—call today to protect your company's future.